Helix

Helix is a financially motivated data-extortion and ransomware brand linked to the broader UNC6671 cybercriminal cluster and associated with the BlackFile, Redact, Pink, and Falcon names. The brand emerged as part of the fragmentation or rebranding of BlackFile in 2026 and shares infrastructure, phishing templates, victimology, and operational tradecraft with those related extortion brands. Security reporting also notes uncertainty over whether these names represent the same core operators, affiliates, splinter groups, or actors using shared phishing infrastructure, but Helix is consistently tied to the same broader ecosystem. Helix specializes in social-engineering-led intrusions rather than exploitation of software vulnerabilities. Its operators have been observed conducting voice-phishing campaigns in which they impersonate corporate IT help desk personnel, often contacting employees on personal mobile devices and creating urgency around security migrations, passkey enrollment, or multi-factor authentication updates. Victims are directed to adversary-in-the-middle phishing portals that capture credentials and MFA tokens, enabling account compromise, session hijacking, and persistent access to enterprise SaaS and identity environments. Post-compromise activity includes abuse of Microsoft 365 and Okta, password-reset abuse for non-SSO applications, deletion of security notifications and alert emails for defense evasion, and automated large-scale data theft from cloud repositories such as mailboxes, OneDrive, and SharePoint. Helix is primarily an extortion actor. It steals data from victim cloud environments and threatens publication if payment is not made. Its operations include leak-site publication, negotiation pressure, and phased release mechanisms in which stolen data is staged into tiers and unlocked on countdown timers to coerce victims. Publicly reported victim interactions show Helix using negotiation pressure, countdowns, and threatened publication after stalled communications. Reporting ties the broader UNC6671 and BlackFile-linked ecosystem to multimillion-dollar ransom collections in 2026, with demands often in the seven-figure range and negotiated settlements frequently reduced from initial asks. Helix has targeted organizations in transportation, financial services, private equity, legal and professional services, insurance, real estate, healthcare, manufacturing, hospitality, technology, and energy-related sectors. Reported victims and targeting patterns show a strong concentration on U.S.-based enterprises, with additional activity affecting Canadian organizations. The group’s later targeting emphasized high-value organizations likely to hold sensitive corporate, investor, litigation, merger-and-acquisition, and client data that can maximize extortion leverage.